CVE-2022-37908: Arubanetworks Arubaos

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.

Affected products

• Arubanetworks Arubaos: from 6.5.4.0, before 6.5.4.23 (fixed in 6.5.4.23); from 8.4.0.0, before 8.6.0.18 (fixed in 8.6.0.18); from 8.7.0.0, before 8.7.1.10 (fixed in 8.7.1.10); from 8.8.0.0, before 8.10.0.0 (fixed in 8.10.0.0); version 10.3.0.0 only
• Arubanetworks SD-WAN: from 8.5.0.0-2.1.0.0, before 8.7.0.0-2.3.0.7 (fixed in 8.7.0.0-2.3.0.7)

Published 2022-12-12. Last modified 2026-10-08.